# -*- coding: utf-8 -*-
# @Author : HaleShi
# @Time : 2023-06-09
# @File : 21_hook_so_sign.py

import frida
import sys

rdev = frida.get_remote_device()
# session = rdev.attach("tv.danmaku.bili")
session = rdev.attach("哔哩哔哩")
scr = """
Java.perform(function () {

    // 找到so的基地址
    var libbili = Module.findBaseAddress("libbili.so");

    //32位系统，需要在内存地址中+1 ,找到函数地址
    var s_func = libbili.add(0x22b0 + 1);
    
    console.log(s_func);

    Interceptor.attach(s_func, {
        onEnter: function (args) {
            // args[0]
            // args[1]，明文字符串
            // args[2]，明文字符串长度

            console.log("执行update，长度是：",args[2], args[2].toInt32());

            // console.log( hexdump(args[1], {length: args[2].toInt32()})  );
            console.log(args[1].readUtf8String())
        },
        onLeave: function (args) {
            console.log("=======================结束===================");
        }
    });
});
"""
script = session.create_script(scr)
script.load()
sys.stdin.read()
